Critical Regular Expression Denial of Service Vulnerability in node-ua-parser-js Package
Summary
UBUNTU-CVE-2022-25927: Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function. Affects node-ua-parser-js versions 0.7.14-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ua-parser-js package is a JavaScript library used for parsing user agent strings. It is widely utilized in web applications to identify the browser, operating system, and device type of users. This package is essential for optimizing user experiences and analytics. However, certain versions of this package are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can lead to performance degradation and potential service outages.
Vulnerability Detail
The vulnerability arises from the trim() function in versions of the ua-parser-js package from 0.7.30 and before 0.7.33, and from 0.8.1 and before 1.0.33. This flaw allows attackers to exploit the regular expression used in the function, leading to excessive CPU consumption and potentially causing denial of service. The impact can be severe, especially for applications that rely heavily on user agent parsing, as it can slow down or crash the application under certain conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize user agent strings before processing them with the vulnerable function. This can help mitigate the risk of exploitation.
Conclusion
The node-ua-parser-js package has a critical vulnerability that can lead to denial of service attacks through the trim() function. It is essential for users of this package to update to the latest patched version to ensure the security and stability of their applications. Regular monitoring and validation practices can also help mitigate risks associated with this vulnerability.
See every vulnerability recorded for node-ua-parser-js →
FAQ
ReDoS is a type of denial of service attack that exploits the performance characteristics of regular expressions, causing excessive resource consumption and potentially crashing the application.
Versions 0.7.30 and earlier than 0.7.33, as well as versions 0.8.1 and earlier than 1.0.33 are vulnerable.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
Yes, you can implement input validation to sanitize user agent strings before processing them, which can help reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for node-ua-parser-js.
